Single Sign-on Extensions Ipad

Hi Tom,

This is a common issue that many admins encounter when configuring the Microsoft Enterprise SSO Extension for iPads with Outlook. The behavior you're seeing - SSO working for most apps but Outlook still prompting for a password - is typically related to how Outlook uses MSAL (Microsoft Authentication Library) for authentication.

Troubleshooting Steps:

1. Verify Microsoft Authenticator is properly deployed
   • The Microsoft Authenticator app must be installed on the device (not just the configuration profile). Ensure it's deployed via VPP/Apple Business Manager as a device-licensed app.
   • Users don't need to configure Authenticator, but it must be present on the device.
2. Update your SSO Extension configuration Your current plist has some configuration issues. Try this updated version:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>AppPrefixAllowList</key>
       <string>com.microsoft.,com.apple.,com.jamf.,com.jamfsoftware.</string>
       <key>browser_sso_interaction_enabled</key>
       <integer>1</integer>
       <key>disable_explicit_app_prompt</key>
       <integer>1</integer>
       <key>disable_explicit_app_prompt_and_autologin</key>
       <integer>1</integer>
   </dict>
   </plist>

Key changes:

• Remove ExtensionIdentifier, TeamIdentifier, URLs, and AppIdentifierAllowList from the custom plist - these should be configured in the SSO Extension payload itself in Jamf Pro, not in the additional configuration
• Added disable_explicit_app_prompt_and_autologin which helps prevent apps from bypassing SSO at the protocol layer

3. Configure SSO Extension in Jamf Pro correctly In your Configuration Profile under Single Sign-On Extensions:
   • Extension Identifier: com.microsoft.azureauthenticator.ssoextension
   • Team Identifier: UBF8T346G9
   • Sign-On Type: Redirect
   • URLs should include:
     • https://login.microsoftonline.com
     • https://login.microsoft.com
     • https://sts.windows.net
     • https://login.partner.microsoftonline.cn
     • https://login.chinacloudapi.cn
     • https://login.microsoftonline.de
     • https://login.microsoftonline.us
     • https://login.usgovcloudapi.net
4. Update your Outlook App Configuration Your App Config variables syntax appears incorrect. Try:

   <dict>
       <key>com.microsoft.outlook.EmailProfile.AccountType</key>
       <string>ModernAuth</string>
       <key>com.microsoft.outlook.EmailProfile.EmailAddress</key>
       <string>{{email}}</string>
       <key>IntuneMAMUPN</key>
       <string>{{userprincipalname}}</string>
   </dict>

5. Check first-time login flow With the SSO Extension, users typically need to complete an initial authentication through the Authenticator app. After that first login, subsequent logins should use SSO. This is expected behavior - the SSO Extension needs to acquire a Primary Refresh Token (PRT) initially.
6. Verify network requirements Ensure the following URLs are allowed and not subject to TLS inspection:
   • https://device.login.microsoftonline.com
   • https://enterpriseregistration.windows.net

Reference Documentation:

• Microsoft Enterprise SSO plug-in for Apple devices
• Configure iOS/iPadOS Enterprise SSO app extension with MDMs
• Troubleshooting the Microsoft Enterprise SSO Extension

Let me know if the issue persists after trying these adjustments!